Mailoo MCP

Last updated: Aug 31, 2026Section: Getting Started

Mailoo exposes agent tools over the Model Context Protocol using remote Streamable HTTP. Your MCP host authenticates with a personal MCP agent token. Actions run as the token owner and never exceed that user's project membership (OWNER or EDITOR, plus optional integration-scoped editors).

Endpoint

  • Production: https://mcp.mailoo.app/mcp

There is no stdio mode. The MCP path does not use project X-API-Key keys and does not use your Keycloak / Auth.js session cookie.

Create an agent token

  1. Sign in to the dashboard.
  2. Open Profile → Security → MCP tokens.
  3. Create a token with a name. The full secret (mai_mcp_…) is shown once---store it securely. Mailoo keeps only a hash at rest.
  4. Revoke a token from the same page when it is no longer needed.

Connect your MCP host

Example Cursor configuration (replace the token secret):

{
  "mcpServers": {
    "mailoo": {
      "url": "https://mcp.mailoo.app/mcp",
      "headers": {
        "Authorization": "Bearer mai_mcp_your-token"
      }
    }
  }
}

Security model

  • Impersonation --- tools act as the owning user.
  • Ceiling --- access cannot exceed project_members (OWNER | EDITOR) and optional integration_members. There is no silent role upgrade.
  • Not an API key --- project API keys use the canonical owner model and optional RESTRICTED operations. MCP resolves membership separately.
  • Secrets --- GET responses are sanitized (flags such as hasSecret); raw SMTP or social tokens are not returned to tools.

Tools

Current tools include:

  • list_projects / create_project
  • get_activity_digest --- counts of recent messages, articles, and chat sessions (not a content list)
  • list_integrations (optional type) / list_blog_integrations
  • create_integration --- any type (FORM, CONTACT_FORM, JSBOX, BLOG, MARKET, SOCIAL); OWNER only
  • create_api_key --- OWNER only; plaintext key once; default RESTRICTED with required allowedOperations
  • manage_blog_integration_settings --- sanitized Connection & settings
  • manage_blog_taxonomy --- classifiers and SEO words
  • list_blog_articles / get_blog_article
  • create_blog_article / update_blog_article / delete_blog_article
  • manage_blog_media --- list, upload, delete images

Typical flow: create or list a project → create a BLOG integration → optional API key for your host app → taxonomy and settings → upload media → create articles.

Prerequisites for blog create

create_blog_article needs at least one author profile for the token owner (Dashboard → Blog → Authors), unless you pass authorProfileId.

  • blog-headless-cms{.interpreted-text role="doc"} --- blog API and classifiers
  • nextjs-packages{.interpreted-text role="doc"} --- host app packages that use API keys
  • OpenAPI at https://api.mailoo.app/docs/v1
📚